Reference

Reference: server.listeners

server.listeners[].address

Socket address to listen on, e.g. 0.0.0.0:443.

server.listeners[].http3

Also serve HTTP/3 over QUIC on the same UDP port (TLS listeners only; off by default). The release packages include it; a source build needs the http3 feature (ADR-0019).

server.listeners[].name

Listener name, used in metrics and logs.

server.listeners[].proxy_protocol

Expect a PROXY protocol v1/v2 header from a trusted proxy on every connection.

server.listeners[].strict_sni

Answer 421 when a request’s host differs from the TLS SNI (ADR-0013).

server.listeners[].tls

TLS settings; absent: plain HTTP.

server.listeners[].tls.acme

Serve ACME-managed certificates of applications with acme: true (ADR-0018).

server.listeners[].tls.certificates

Certificates with the names they serve; the client’s SNI selects one.

server.listeners[].tls.certificates[].cert

PEM file with the end-entity certificate first, followed by intermediates.

server.listeners[].tls.certificates[].default

Used when the client sends no SNI or an unknown name. At most one per listener.

server.listeners[].tls.certificates[].key

PEM file with the private key (PKCS#8, PKCS#1 or SEC1).

server.listeners[].tls.certificates[].server_names

Host names (exact or *.example.com) this certificate is selected for via SNI. Each must be covered by the certificate’s SANs. Empty only for the default certificate, which is then served only for an absent or unknown SNI name.

server.listeners[].tls.certificates_file

YAML file with more certificate entries (a list with the keys of certificates), read when the configuration is loaded and appended to certificates. Relative to the configuration file; a leading - makes a missing file mean “no entries”.